From owner-svn-ports-branches@freebsd.org Thu May 7 19:56:39 2020 Return-Path: Delivered-To: svn-ports-branches@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 8A89B2E3AC4; Thu, 7 May 2020 19:56:39 +0000 (UTC) (envelope-from mandree@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 49J43W381Kz4fQv; Thu, 7 May 2020 19:56:39 +0000 (UTC) (envelope-from mandree@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 672BE1E6C8; Thu, 7 May 2020 19:56:39 +0000 (UTC) (envelope-from mandree@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 047Judig044664; Thu, 7 May 2020 19:56:39 GMT (envelope-from mandree@FreeBSD.org) Received: (from mandree@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 047JudIS044663; Thu, 7 May 2020 19:56:39 GMT (envelope-from mandree@FreeBSD.org) Message-Id: <202005071956.047JudIS044663@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: mandree set sender to mandree@FreeBSD.org using -f From: Matthias Andree Date: Thu, 7 May 2020 19:56:39 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r534284 - in branches/2020Q2/mail/mailman: . files X-SVN-Group: ports-branches X-SVN-Commit-Author: mandree X-SVN-Commit-Paths: in branches/2020Q2/mail/mailman: . files X-SVN-Commit-Revision: 534284 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-branches@freebsd.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: SVN commit messages for all the branches of the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 May 2020 19:56:39 -0000 Author: mandree Date: Thu May 7 19:56:38 2020 New Revision: 534284 URL: https://svnweb.freebsd.org/changeset/ports/534284 Log: mail/mailman: fix another content injection vuln via private archive login This led up to mailman 2.1.33 today. https://bugs.launchpad.net/mailman/+bug/1877379 https://launchpadlibrarian.net/478684932/private.diff https://mail.python.org/archives/list/mailman-developers@python.org/thread/SYBIZ3MNSQZLKN6PVKO7ZKR7QMOBMS45/ Approved by: ports-secteam@ (blanket for security fixes) Security: 88760f4d-8ef7-11ea-a66d-4b2ef158be83 Added: branches/2020Q2/mail/mailman/files/patch-1-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83 (contents, props changed) Modified: branches/2020Q2/mail/mailman/Makefile Modified: branches/2020Q2/mail/mailman/Makefile ============================================================================== --- branches/2020Q2/mail/mailman/Makefile Thu May 7 19:56:00 2020 (r534283) +++ branches/2020Q2/mail/mailman/Makefile Thu May 7 19:56:38 2020 (r534284) @@ -3,7 +3,7 @@ PORTNAME= mailman DISTVERSION= 2.1.30 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= mail MASTER_SITES= GNU \ SF/${PORTNAME}/Mailman%202.1%20%28stable%29/${PORTVERSION} \ Added: branches/2020Q2/mail/mailman/files/patch-1-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ branches/2020Q2/mail/mailman/files/patch-1-security-88760f4d-8ef7-11ea-a66d-4b2ef158be83 Thu May 7 19:56:38 2020 (r534284) @@ -0,0 +1,29 @@ +This is essentially the same as https://bugs.launchpad.net/mailman/+bug/1873722 +except the vector is the private archive login page and the attack only +succeeds if the list's roster visibility (private_roster) setting is 'Anyone'. + +This is fixed by the attached patch. + +Source: https://bugs.launchpad.net/mailman/+bug/1877379 +Deep: https://launchpadlibrarian.net/478684932/private.diff + +--- Mailman/Cgi/private.py 2019-03-06 17:48:32 +0000 ++++ Mailman/Cgi/private.py 2020-05-07 13:42:03 +0000 +@@ -162,13 +162,9 @@ + if mlist.isMember(username): + mlist.MailUserPassword(username) + elif username: +- # Not a member +- if mlist.private_roster == 0: +- # Public rosters +- safeuser = Utils.websafe(username) +- message = Bold(FontSize('+1', +- _('No such member: %(safeuser)s.'))).Format() +- else: ++ # Not a member. Don't report address in any case. It leads to ++ # Content injection. Just log if roster is not public. ++ if mlist.private_roster != 0: + syslog('mischief', + 'Reminder attempt of non-member w/ private rosters: %s', + username) +